How do they deal with the intel management engine in all intel chips? https://libreboot.org/faq/
ORWL – The first open source, physically secure computer
11–20 of 195 posts
Re: ORWL – The first open source, physically secure computer
#12Having some physical security in a OSS-hacker-compliant form factor is really quite nice. This is not going to replace a proper HSM, and almost certainly is a less secure place to store your data than an iPhone; but it's a good start for those unwilling to give up on (the performance of) PCs. It's worth noting that QubesOS, which is supported by this system, protects against e.g. USB-based attacks by running a virtua…
[deleted]
Re: ORWL – The first open source, physically secure computer
#13> If someone has physical access to your computer with secure documents present, it’s game over! Err, why? Is AES encryption not sufficient? And the key is secure in my head - not something someone could steal. So, why is this even a thing?
Unless you also want to perform the AES operations in your head, you have to rely on the hardware and software of your computer to perform them. An attacker could then replace the AES routine you use with one that stores a shadow copy of your key, or exfiltrates it over some covert channel.
What if the crypto side of things is remove-able and carry-able on your person? Or what if it could be subdermally implanted so you know no one can pick pocket you and replace it?
Just a thought.
Re: ORWL – The first open source, physically secure computer
#14It's an interesting concept, for sure – but could someone more knowledgeable than me explain whether this leaves the system vulnerable to the potential, alleged backdoors present in Intel's chips via the Intel Management Engine?
Re: ORWL – The first open source, physically secure computer
#15Enjoy spending the next 10k years auditing the security of the chipset with your scanning tunneling microscope.
Even if it doesn't protect yourself against some transistor level NSA backdoor, that doesn't mean it can't thwart other attackers who would usually take advantage of physical access.
Re: ORWL – The first open source, physically secure computer
#16> If someone has physical access to your computer with secure documents present, it’s game over! Err, why? Is AES encryption not sufficient? And the key is secure in my head - not something someone could steal. So, why is this even a thing?
The key isn't in your head: you know the passphrase used to decrypt the key which is then kept in system memory. Techniques like the cold boot attack[0] or row hammer[1] can be used to retrieve the key and access your data. In the case of non-hardware-TPM secured encryption schemes the kernel or bootloader which must remain unencrypted for the system to boot can be backdoored to record the passphrase and/or the key.
Re: ORWL – The first open source, physically secure computer
#17Great project! but unless the computer is used to do only offline tasks then having a physical key is as useful as locking a door and leaving the keys on (hardware level backdoors, zero-day attacks, lack of end to end cryptography etc.)
Re: ORWL – The first open source, physically secure computer
#18This doesn't seem all that secure. Against an Evil Maid attack, your best mitigation is to be able to keep everything, OS and all, on a portable drive which is self-encrypting; essentially an encrypted PE.
Re: ORWL – The first open source, physically secure computer
#19How do they deal with the intel management engine in all intel chips? https://libreboot.org/faq/
Didn't know about this. They should have gone with AMD.
Re: ORWL – The first open source, physically secure computer
#20How do they deal with the intel management engine in all intel chips? https://libreboot.org/faq/
Didn't know about this. They should have gone with AMD.
https://libreboot.org/faq/#amd. ARM maybe?